The hook
PickleScan often sits in the safety path for AI model ingestion. A scanner bypass matters because teams may treat a clean scan as permission to load a model archive, but a repository dependency match is still version evidence rather than proof that untrusted models reach production.
How it works
The repo check looks for the PyPI `picklescan` package in Python dependency manifests and lockfiles. Exact lockfile pins produce the strongest signal; broader manifest ranges are reported when they clearly allow versions before 0.0.31.
The blast radius
If an affected PickleScan runtime scans untrusted ZIP, PyTorch, or pickle-containing archives and the surrounding workflow ignores scan errors, malicious payloads may avoid detection before a model is loaded. A repo match should drive dependency remediation and model-ingestion review before anyone treats the issue as confirmed runtime code execution.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade `picklescan` to 0.0.31 or newer, regenerate the active Python lockfile, and rebuild every CI, model-ingestion, training, inference, notebook, worker, or security-scanning runtime that uses it. Make scan errors fail closed, keep model artifacts provenance-checked, and use only benign archive/model smoke tests for verification.